A threat actor claims to have breached Gerar (gerar.org.br), a Brazilian platform for professional training and job placement focused on “qualification and income generation.” The actor is attempting to sell a large volume of data, reportedly totaling 546GB in files and an additional 14GB database.
The post advertising the sale also alleges that the actor maintains ongoing access to the platform’s systems via a “backdoor.”
According to the actor, the compromised data includes a massive collection of sensitive personal documents from over 400,000 records in one database table alone. The types of documents allegedly exfiltrated include:
- Work Card
- General Registry (RG)
- Personal Certificate
- Birth Certificate
- Driver’s License
- Military Service / Reservist documents
- Bank Documentation
- Proof of Residence
- CPF (individual taxpayer IDs)
